CVE-2026-73030

The core vulnerability in `unearth` is a path traversal flaw in archive extraction where the function `is_within_directory` creates a dangerous illusion of safety. It performs string-based path comparison without normalizing paths first, meaning `../../../etc/passwd` can pass its check if the extraction logic simply prepends a target directory and relies on this function to catch containment violations. The fix in commit 6c78164 adds `os.path.normpath()` before comparison—this closes the string-based traversal vector. However, and this is critical: path normalization does not address symlink attacks. If a tar entry is a symlink pointing outside the target directory, `is_within_directory` never sees a `../` sequence—it sees a resolved path that looks contained. The symlink bypasses the string check entirely. This means the CVE bundles two distinct attack vectors under one fix, and if you're depending on this patch for complete protection, you likely still have exposure. What you should verify: confirm that any code using `unearth` for extraction also implements explicit symlink handling—either rejecting symlink entries entirely, resolving them in-memory before extraction, or placing extracted symlinks in a location that can't trigger privilege escalation. Simply upgrading to the patched version does not guarantee symlink safety if the library doesn't enforce it at the extraction API level. The deeper lesson is about security boundary design. A function named `is_within_directory` semantically promises 'tell me if this path is safe'—not 'tell me if this path is safe, assuming you've already normalized it.' That naming shifted invisible cognitive burden onto every caller, each expected to independently realize the check is incomplete. This is a design smell: security boundaries should be atomic, not composable from partial checks that require security expertise to assemble correctly. The existence of `is_within_directory` as a separate public API created attack surface that the extraction logic then depended on incorrectly. When evaluating archive handling libraries, prefer extraction APIs that bundle normalization, symlink handling, and containment enforcement into single atomic operations—anything requiring callers to compose security checks is a vector waiting to be misused.

Reviewed through automated stages and approved by a human before publication.